aboutsummaryrefslogtreecommitdiffstats
path: root/modules/vhack/ma
diff options
context:
space:
mode:
Diffstat (limited to 'modules/vhack/ma')
-rw-r--r--modules/vhack/ma/mail/module.nix371
-rw-r--r--modules/vhack/ma/mastodon/module.nix128
-rw-r--r--modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch40
-rw-r--r--modules/vhack/ma/matrix/module.nix181
4 files changed, 720 insertions, 0 deletions
diff --git a/modules/vhack/ma/mail/module.nix b/modules/vhack/ma/mail/module.nix
new file mode 100644
index 0000000..e4cb83c
--- /dev/null
+++ b/modules/vhack/ma/mail/module.nix
@@ -0,0 +1,371 @@
+{
+ config,
+ lib,
+ ...
+}: let
+ cfg = config.vhack.mail;
+in {
+ options.vhack.mail = {
+ enable = lib.mkEnableOption "sophisticated mail setup with simple-nixos-mailserver";
+ fqdn = lib.mkOption {
+ type = lib.types.str;
+ description = "The fqdn mailserver should be served on.";
+ };
+
+ domains = lib.mkOption {
+ type = lib.types.listOf lib.types.str;
+ example = ["example.com"];
+ default = [];
+ description = "The domains that this mail server serves.";
+ };
+
+ accounts = lib.mkOption {
+ type = lib.types.attrsOf (
+ lib.types.submodule (
+ {name, ...}: {
+ options = {
+ name = lib.mkOption {
+ type = lib.types.str;
+ default = name;
+ example = "user1@example.com";
+ readOnly = true;
+ internal = true;
+ description = ''
+ The login username for this account.
+ '';
+ };
+
+ hashedPassword = lib.mkOption {
+ type = lib.types.nullOr lib.types.str;
+ default = null;
+ example = "$y$j9T$vfGrwkAaXCjCEWtVNMQck1$383uIXQmn2z0hnmVAA8kwFQmjNj78.nYbvWeyNLIaP1";
+ description = ''
+ The hashed login password for this account.
+
+ Use `mkpasswd` to create password hashes:
+ ```
+ nix-shell -p mkpasswd --run 'mkpasswd -s'
+ ```
+
+ :::{note}
+ This is a convenience option, when your threat model allows
+ storing hashed secrets in the world-readable Nix store.
+
+ Passing the hash through
+ {option}`mailserver.accounts.<name>.hashedPasswordFile`
+ allows relying on filesystem discretionary access control as
+ another security boundary.
+ :::
+ '';
+ };
+
+ hashedPasswordFile = lib.mkOption {
+ type = lib.types.nullOr lib.types.path;
+ default = null;
+ example = "/run/keys/user1-pw-hash";
+ description = ''
+ The hashed login password for this account read from a file.
+
+ Use `mkpasswd to create password hashes:
+ ```
+ nix-shell -p mkpasswd --run 'mkpasswd -s'
+ ```
+ '';
+ };
+
+ passwordFile = lib.mkOption {
+ type = with lib.types;
+ nullOr (pathWith {
+ inStore = false;
+ });
+ default = null;
+ example = "/run/keys/user1-pw";
+ description = ''
+ The plaintext login password for this account read from a file.
+
+ :::{note}
+ The password is hashed before it is passed on to Dovecot.
+ :::
+ '';
+ };
+
+ aliases = lib.mkOption {
+ type = with lib.types; listOf types.str;
+ example = [
+ "abuse@example.com"
+ "postmaster@example.com"
+ ];
+ default = [];
+ description = ''
+ List of additional mail addresses (aliases) that get routed to this account.
+
+ :::{admonition} Catch-all with sending permissions
+ :class: tip
+ Configure `@example.com` to create a catch-all for this domain
+ that also allows sending from all addresses.
+ :::
+ '';
+ };
+
+ aliasesRegexp = lib.mkOption {
+ type = with lib.types; listOf types.str;
+ example = [''/^tom\..*@domain\.com$/''];
+ default = [];
+ description = ''
+ Same as {option}`mailserver.accounts.<name>.aliases` but
+ using PCRE (Perl compatible regex).
+ '';
+ };
+
+ catchAll = lib.mkOption {
+ type = with lib.types; listOf (enum cfg.domains);
+ example = [
+ "example.com"
+ "example2.com"
+ ];
+ default = [];
+ description = ''
+ For which domains should this account act as a catch all?
+
+ :::{warning}
+ Does not allow sending from all addresses of these domains.
+ Use {option}`mailserver.accounts.<name>.aliases` if that
+ is required.
+ :::
+ '';
+ };
+
+ quota = lib.mkOption {
+ type = with lib.types; nullOr types.str;
+ default = null;
+ example = "2G";
+ description = ''
+ The quota limit for this user.
+
+ The value is must use a size format like `500M`, `2G`, `10G`.
+
+ If unset, will fall back to {option}`mailserver.quota.defaults.perUser` if set.
+ '';
+ };
+
+ sieveScript = lib.mkOption {
+ type = with lib.types; nullOr lines;
+ default = null;
+ example = ''
+ require ["fileinto", "mailbox"];
+
+ if address :is "from" "gitlab@mg.gitlab.com" {
+ fileinto :create "GitLab";
+ stop;
+ }
+
+ # This must be the last rule, it will check if list-id is set, and
+ # file the message into the Lists folder for further investigation
+ elsif header :matches "list-id" "<?*>" {
+ fileinto :create "Lists";
+ stop;
+ }
+ '';
+ description = ''
+ Per-user sieve script.
+ '';
+ };
+
+ sendOnly = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = ''
+ Specifies if the account should be a send-only account.
+
+ Emails sent to send-only accounts will
+ be rejected with the reason configured in
+ {option}`mailserver.accounts.<name>.sendOnlyRejectMessage`.
+ '';
+ };
+
+ sendOnlyRejectMessage = lib.mkOption {
+ type = lib.types.str;
+ default = "This account cannot receive emails.";
+ description = ''
+ The message returned to the sender for a send-only account.
+
+ See {option}`mailserver.accounts.<name>.sendOnly`.
+ '';
+ };
+ };
+ }
+ )
+ );
+ example = lib.literalExpression ''
+ {
+ user1 = {
+ # This password hash leaks into the Nix store
+ hashedPassword = "$y$j9T$y6eZ1o.IvVNfdGMAsUEvh1$6K/llP52uw2iDh4iSwtAn54/JYy7FzCcoCHmjmx00H5";
+ };
+ user2 = {
+ # Hashed password passed as a file
+ hashedPasswordFile = "/run/keys/user2-pw-hash";
+ };
+ user3 = {
+ # Plaintext password file
+ passwordFile = "/run/keys/user3-pw";
+ };
+ }
+ '';
+ description = ''
+ Attribute set of mail accounts.
+
+ Each entry defines a mailbox and login credentials, where the attribute
+ name is used as the login username and optionally routed mail address.
+
+ Use `mkpasswd` to generate password hashes.
+ '';
+ default = {};
+ };
+
+ security = lib.mkOption {
+ type = lib.types.submodule {
+ options = {
+ dkimKeys = lib.mkOption {
+ type = lib.types.nullOr (lib.types.attrsOf (lib.types.submodule {
+ options = {
+ dkimPublicKey = lib.mkOption {
+ type = lib.types.str;
+ description = ''
+ The base 64 encoded representation of the public dkim key.
+ '';
+ };
+ dkimPrivateKeyPath = lib.mkOption {
+ type = lib.types.path;
+ description = ''
+ Path to the file for the pre-generated dkim key file.
+ Should not point to the nixos store.
+ '';
+ };
+ keyAlgorithm = lib.mkOption {
+ type = lib.types.enum ["ed25519-sha256" "rsa-sha-256" "rsa-sha-1"];
+ description = "The algorithm of the used key";
+ };
+ };
+ }));
+ description = ''
+ Which key to use for which domain. The attr keys are the domains
+ '';
+ default = null;
+ };
+ };
+ };
+ description = ''
+ Security options.
+ '';
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ vhack.persist.directories = [
+ {
+ directory = "/var/lib/mail/backup";
+ user = "virtualMail";
+ group = "virtualMail";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/mail/vmail";
+ user = "virtualMail";
+ group = "virtualMail";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/mail/dkim";
+ user = "opendkim";
+ group = "opendkim";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/postfix/data";
+ user = "postfix";
+ group = "postfix";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/postfix/queue";
+ user = "postfix";
+ group = "postfix";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/rspamd";
+ user = "rspamd";
+ group = "rspamd";
+ mode = "0700";
+ }
+ ];
+
+ vhack.nginx.enable = true;
+
+ services.nginx.virtualHosts = {
+ "${cfg.fqdn}" = {
+ enableACME = true;
+ forceSSL = true;
+ };
+ };
+
+ mailserver = {
+ enable = true;
+ inherit (cfg) fqdn;
+
+ stateVersion = 5;
+
+ storage = {
+ directoryLayout = "fs";
+ path = "/var/lib/mail/vmail";
+ };
+
+ dkim = let
+ dkimKeys =
+ builtins.mapAttrs (name: value: {
+ selectors."mail".keyFile =
+ value.dkimPrivateKeyPath;
+ })
+ cfg.security.dkimKeys;
+ in {
+ domains = lib.mkIf (cfg.security.dkimKeys != null) dkimKeys;
+ keyDirectory = lib.mkIf (cfg.security.dkimKeys == null) "/var/lib/mail/dkim";
+ };
+
+ backup.snapshotRoot = "/var/lib/mail/backup";
+
+ enableImap = false;
+ enableImapSsl = true;
+ enablePop3 = false;
+ enablePop3Ssl = true;
+ # SMTP
+ enableSubmission = false;
+ enableSubmissionSsl = true;
+ openFirewall = true;
+
+ # Reference the existing ACME configuration created by nginx
+ x509.useACMEHost = cfg.fqdn;
+
+ inherit (cfg) domains accounts;
+ };
+
+ users = {
+ users = {
+ knot-resolver = {
+ uid = config.vhack.constants.ids.uids.knot-resolver;
+ group = "knot-resolver";
+ };
+ redis-rspamd.uid = config.vhack.constants.ids.uids.redis-rspamd;
+ rspamd.uid = config.vhack.constants.ids.uids.rspamd;
+ postfix-tlspol.uid = config.vhack.constants.ids.uids.postfix-tlspol;
+ };
+ groups = {
+ knot-resolver.gid = lib.mkForce config.vhack.constants.ids.gids.knot-resolver;
+ redis-rspamd.gid = config.vhack.constants.ids.gids.redis-rspamd;
+ rspamd.gid = config.vhack.constants.ids.gids.rspamd;
+ postfix-tlspol.gid = config.vhack.constants.ids.gids.postfix-tlspol;
+ };
+ };
+ };
+}
diff --git a/modules/vhack/ma/mastodon/module.nix b/modules/vhack/ma/mastodon/module.nix
new file mode 100644
index 0000000..84f3ec8
--- /dev/null
+++ b/modules/vhack/ma/mastodon/module.nix
@@ -0,0 +1,128 @@
+{
+ config,
+ pkgs,
+ lib,
+ ...
+}: let
+ emailAddress = "mastodon@vhack.eu";
+ applyPatches = pkg:
+ pkg.overrideAttrs (attrs: {
+ patches = (attrs.patches or []) ++ [./patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch];
+ });
+ cfg = config.vhack.mastodon;
+in {
+ options.vhack.mastodon = {
+ enable = lib.mkEnableOption "a mastodon instance";
+ domain = lib.mkOption {
+ type = lib.types.str;
+ description = "The Domain mastodon should be served on";
+ example = "mastodon.vhack.eu";
+ };
+ enableTLD = lib.mkEnableOption "using the tld as handle, configured via
+ webfinger (note: this requires the tld to point to the same server as domain)";
+ tld = lib.mkOption {
+ type = lib.types.nullOr lib.types.str;
+ default = null;
+ example = "vhack.eu";
+ };
+ mailPwFile = lib.mkOption {
+ type = lib.types.path;
+ description = "The age encrypted mail password file passed to agenix";
+ };
+ };
+ config = lib.mkIf cfg.enable {
+ age.secrets.mastodonMail = {
+ file = cfg.mailPwFile;
+ mode = "700";
+ owner = "mastodon";
+ group = "mastodon";
+ };
+
+ vhack = {
+ persist.directories = [
+ {
+ directory = "/var/lib/mastodon";
+ user = "mastodon";
+ group = "mastodon";
+ mode = "0700";
+ }
+ ];
+
+ postgresql.enable = true;
+
+ nginx.enable = true;
+ };
+
+ services.mastodon = {
+ enable = true;
+
+ package = applyPatches pkgs.mastodon;
+
+ # Unstable Mastodon package, used if
+ # security updates aren't backported.
+ #package = applyPatches pkgsUnstable.mastodon;
+
+ localDomain =
+ if cfg.enableTLD
+ then cfg.tld
+ else cfg.domain;
+ smtp = {
+ authenticate = true;
+ createLocally = false;
+ fromAddress = emailAddress;
+ user = emailAddress;
+ host = "mail.foss-syndicate.org";
+ passwordFile = config.age.secrets.mastodonMail.path;
+ };
+ streamingProcesses = 3; # Number of Cores - 1
+ extraConfig = {
+ WEB_DOMAIN = cfg.domain;
+ EMAIL_DOMAIN_ALLOWLIST = "vhack.eu|sils.li";
+ };
+ };
+
+ services.nginx = {
+ enable = true;
+ recommendedProxySettings = true; # required for redirections to work
+ virtualHosts = {
+ "${cfg.domain}" = {
+ root = "${config.services.mastodon.package}/public/";
+ # mastodon only supports https, but you can override this if you offload tls elsewhere.
+ forceSSL = true;
+ enableACME = true;
+
+ locations = {
+ "/system/".alias = "/var/lib/mastodon/public-system/";
+ "/".tryFiles = "$uri @proxy";
+ "@proxy" = {
+ proxyPass = "http://unix:/run/mastodon-web/web.socket";
+ proxyWebsockets = true;
+ };
+ "/api/v1/streaming/" = {
+ proxyPass = "http://unix:/run/mastodon-streaming/streaming.socket";
+ proxyWebsockets = true;
+ };
+ };
+ };
+ "${cfg.tld}" =
+ if cfg.enableTLD
+ then {
+ locations."/.well-known/webfinger".return = "301 https://${cfg.domain}$request_uri";
+ }
+ else {};
+ };
+ };
+
+ users = {
+ users.mastodon.uid = config.vhack.constants.ids.uids.mastodon;
+ users.redis-mastodon.uid = config.vhack.constants.ids.uids.redis-mastodon;
+ groups.redis-mastodon.gid = config.vhack.constants.ids.gids.redis-mastodon;
+ groups.mastodon = {
+ gid = config.vhack.constants.ids.gids.mastodon;
+ members = [
+ config.services.nginx.user
+ ];
+ };
+ };
+ };
+}
diff --git a/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch b/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
new file mode 100644
index 0000000..870492a
--- /dev/null
+++ b/modules/vhack/ma/mastodon/patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch
@@ -0,0 +1,40 @@
+From 265bc7b12ab8229225b13565a361051b9e120792 Mon Sep 17 00:00:00 2001
+From: Benedikt Peetz <benedikt.peetz@b-peetz.de>
+Date: Tue, 7 Jul 2026 11:34:50 +0200
+Subject: [PATCH] feat(treewide): Increase character limit to 5000 in messages
+
+The default of 500 was just not enough.
+---
+ .../features/compose/containers/compose_form_container.js | 2 +-
+ app/validators/status_length_validator.rb | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+index c5cffff10d..2172a0ad8f 100644
+--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
++++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
+@@ -58,7 +58,7 @@ const mapStateToProps = state => ({
+ && !state.getIn(['settings', 'dismissed_banners', PRIVATE_QUOTE_MODAL_ID]),
+ isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
+ lang: state.getIn(['compose', 'language']),
+- maxChars: state.getIn(['server', 'server', 'item', 'configuration', 'statuses', 'max_characters'], 500),
++ maxChars: state.getIn(['server', 'server', 'item', 'configuration', 'statuses', 'max_characters'], 5000),
+ });
+
+ const mapDispatchToProps = (dispatch, props) => ({
+diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
+index 575aaf1869..ecefca6fe9 100644
+--- a/app/validators/status_length_validator.rb
++++ b/app/validators/status_length_validator.rb
+@@ -1,7 +1,7 @@
+ # frozen_string_literal: true
+
+ class StatusLengthValidator < ActiveModel::Validator
+- MAX_CHARS = 500
++ MAX_CHARS = 5000
+ URL_PLACEHOLDER_CHARS = 23
+ URL_PLACEHOLDER = 'x' * 23
+
+--
+2.54.0
+
diff --git a/modules/vhack/ma/matrix/module.nix b/modules/vhack/ma/matrix/module.nix
new file mode 100644
index 0000000..39631ef
--- /dev/null
+++ b/modules/vhack/ma/matrix/module.nix
@@ -0,0 +1,181 @@
+{
+ config,
+ lib,
+ ...
+}: let
+ cfg = config.vhack.matrix;
+ clientConfig."m.homeserver".base_url = "https://${cfg.fqdn}";
+ serverConfig."m.server" = "${cfg.fqdn}:443";
+ mkWellKnown = data: ''
+ add_header Content-Type application/json;
+ add_header Access-Control-Allow-Origin *;
+ return 200 '${builtins.toJSON data}';
+ '';
+in {
+ options.vhack.matrix = {
+ enable = lib.mkEnableOption "matrix setup based on synapse";
+ fqdn = lib.mkOption {
+ type = lib.types.str;
+ description = "The FQDN on which matrix-synapse should be served.";
+ example = "matrix.vhack.eu";
+ };
+ url = lib.mkOption {
+ type = lib.types.str;
+ description = "The url the matrix-server should be known under.";
+ };
+ sharedSecretFile = lib.mkOption {
+ type = lib.types.path;
+ description = "The age encrypted shared secret file for synapse, passed to agenix";
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ age.secrets.matrix-synapse_registration_shared_secret = {
+ file = cfg.sharedSecretFile;
+ mode = "700";
+ owner = "matrix-synapse";
+ group = "matrix-synapse";
+ };
+ networking.firewall.allowedTCPPorts = [80 443];
+
+ vhack = {
+ persist.directories = [
+ {
+ directory = "/var/lib/matrix";
+ user = "matrix-synapse";
+ group = "matrix-synapse";
+ mode = "0700";
+ }
+ {
+ directory = "/var/lib/mautrix-whatsapp";
+ user = "mautrix-whatsapp";
+ group = "matrix-synapse";
+ mode = "0750";
+ }
+ ];
+
+ postgresql.enable = true;
+ nginx.enable = true;
+ };
+
+ systemd = {
+ tmpfiles.rules = [
+ "d /etc/matrix 0755 matrix-synapse matrix-synapse"
+ ];
+ # TODO: Do we still need this? <2025-12-18>
+ # The `$PSQL` env var seemed to go away between the 25.05 -> 25.11 update
+ # services.postgresql.postStart = ''
+ # $PSQL -tAc "ALTER ROLE \"matrix-synapse\" WITH PASSWORD 'synapse';"
+ # $PSQL -tAc "ALTER ROLE \"mautrix-whatsapp\" WITH PASSWORD 'whatsapp';"
+ # '';
+ };
+
+ services = {
+ postgresql = {
+ enable = true;
+ ensureUsers = [
+ {
+ name = "matrix-synapse";
+ ensureDBOwnership = true;
+ }
+ {
+ name = "mautrix-whatsapp";
+ ensureDBOwnership = true;
+ }
+ ];
+ ensureDatabases = [
+ "matrix-synapse"
+ "mautrix-whatsapp"
+ ];
+ };
+
+ nginx = {
+ enable = true;
+ recommendedTlsSettings = true;
+ recommendedOptimisation = true;
+ recommendedGzipSettings = true;
+ recommendedProxySettings = true;
+ virtualHosts = {
+ "${cfg.url}" = {
+ enableACME = true;
+ forceSSL = true;
+ locations = {
+ "/.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
+ "/.well-known/matrix/client".extraConfig = mkWellKnown clientConfig;
+ };
+ };
+ "${cfg.fqdn}" = {
+ enableACME = true;
+ forceSSL = true;
+ locations = {
+ "/".return = "404";
+ "/_matrix".proxyPass = "http://[::1]:8008";
+ "/_synapse/client".proxyPass = "http://[::1]:8008";
+ };
+ };
+ };
+ };
+
+ mautrix-whatsapp = {
+ # FIXME(@bpeetz): This was disabled because `mautrix-whatsapp` dependends on libolm.
+ # Re-enable it, when this has changed. <2024-09-06>
+ enable = false;
+ settings = {
+ appservice = {
+ database = {
+ type = "postgres";
+ uri = "postgres:///mautrix-whatsapp?host=/run/postgresql";
+ };
+ whatsapp = {
+ # TODO: See https://github.com/tulir/whatsmeow/blob/efc632c008604016ddde63bfcfca8de4e5304da9/binary/proto/def.proto#L43-L64 for a list.
+ # This also determines the WhatsApp icon
+ browser_name = "unknown";
+ };
+ };
+ homeserver.address = "https://${cfg.fqdn}";
+ bridge.permissions = {
+ "@soispha:vhack.eu" = "admin";
+ "@sils:vhack.eu" = "admin";
+ "@nightingale:vhack.eu" = "admin";
+ };
+ };
+ };
+
+ matrix-synapse = {
+ enable = true;
+ dataDir = "/var/lib/matrix";
+ configFile = "/etc/matrix/matrix.conf";
+ settings = {
+ media_store_path = "/var/lib/matrix/media_store";
+ registration_shared_secret_path = "${config.age.secrets.matrix-synapse_registration_shared_secret.path}";
+ server_name = cfg.url;
+ listeners = [
+ {
+ port = 8008;
+ bind_addresses = ["::1"];
+ type = "http";
+ tls = false;
+ x_forwarded = true;
+ resources = [
+ {
+ names = ["client" "federation"];
+ compress = true;
+ }
+ ];
+ }
+ ];
+ };
+ };
+ };
+ users = {
+ users = {
+ matrix-synapse.uid = config.vhack.constants.ids.uids.matrix-synapse;
+ mautrix-whatsapp = {
+ uid = config.vhack.constants.ids.uids.mautrix-whatsapp;
+ group = "matrix-synapse";
+ };
+ };
+ groups.matrix-synapse.gid = config.vhack.constants.ids.gids.matrix-synapse;
+ };
+ };
+}
generated by cgit v1.3.1 (git 2.54.0) at 2026-11-10 08:47:52 +0000